SB2022101275 - Improper control of a resource through its lifetime in Junos OS Evolved and Juniper Junos OS

Description

This security bulletin contains information about 1 security vulnerability.

1) Improper control of a resource through its lifetime (CVE-ID: CVE-2022-22250)

The vulnerability allows a remote non-authenticated attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to improper control of a resource through its lifetime error in Packet Forwarding Engine (PFE). A remote non-authenticated attacker can cause a Denial of Service (DoS).

In an EVPN-MPLS scenario, if MAC is learned locally on access interface but later a request to delete is received indicating that the MAC was learnt remotely, it might lead to memory corruption which might result in line card crash and reload.

Remediation

Install update from vendor's website.

References

• https://supportportal.juniper.net/s/article/2022-10-Security-Bulletin-Junos-OS-and-Junos-OS-Evolved-An-FPC-might-crash-and-reload-if-the-EVPN-MAC-entry-is-move-from-local-to-remote-CVE-2022-22250